Enum RateLimitUnit 

pub enum RateLimitUnit {
    Second,
    Minute,
    Hour,
}

Typed closed-set enum for the three canonical :politicas :rate-limit :window units — Second / Minute / Hour — the rate_limit_codec round-trips losslessly ("<n>/s" / "<n>/m" / "<n>/h").

The {"s" ↔ 1s, "m" ↔ 60s, "h" ↔ 3600s} bijection every consumer of the :politicas :rate-limit unit surface reads from ([rate_limit_codec::parse]’s unit → Duration dispatch, [rate_limit_codec::render]’s Duration → unit projection, the [is_canonical_rate_limit_window] predicate the AplicacaoSpec::validate_politicas gate keys off, the future M4 per-Aplicacao Envoy config reconciler’s local_rate_limit.token_bucket.fill_interval projection) now lives inside this typed enum’s match self arms — a future rate-limit-unit addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support) is one new variant plus the exhaustiveness arms on the four methods, so every consumer picks it up by compile-time construction rather than a runtime table-scan miss.

The prior RATE_LIMIT_UNIT_TABLE: &[(&str, u64)] slice-of-tuples was scanned via find_map at every projection call — an untyped runtime walk that carried no compile-time link between the parse arm’s accepted suffixes, the render arm’s emitted suffixes, and the validate gate’s accepted windows. A future rate-limit-unit addition that landed one row without threading through the other consumers (or a copy-paste flip that collapsed two rows onto one suffix) would silently split the accepted-set across the three consumers — the parse arm accepts "d" and rejects "s", the render arm emits "h" for a 24h window that parse can’t round-trip, the validate gate misses one canonical window. Lifting the pairs onto a typed closed-set enum with exhaustive match arms makes any such half-landed extension a caixa-core build error (the compiler enforces arm coverage on every method), not a silent per-consumer drift surfacing at apply time. Same “closed-set typed-enum discriminator” discipline the sibling PlacementStrategy (cc8f749), crate::supervisor::RestartStrategy, crate::supervisor::RestartPolicy, crate::upgrade::UpgradeInstruction, and crate::CaixaKind closed-set typed enums carry on their respective closed-set axes — extended onto the seventh closed-set typed-enum discriminator axis on the caixa typed surface (the :politicas :rate-limit :window canonical-unit axis).

Variants

Second

1-second window — canonical author-surface suffix "s" ("<n>/s"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 1s magnitude.

Minute

1-minute window — canonical author-surface suffix "m" ("<n>/m"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 60s magnitude.

Hour

1-hour window — canonical author-surface suffix "h" ("<n>/h"), maps onto Envoy’s local_rate_limit.token_bucket.fill_interval with a 3600s magnitude.

Implementations

impl RateLimitUnit

pub const fn is_second(&self) -> bool

pub const fn is_minute(&self) -> bool

pub const fn is_hour(&self) -> bool

impl RateLimitUnit

pub const ALL: &'static [Self]

Exhaustive iteration surface for every consumer that reads the full canonical-unit set (the byte-parity witness against the prior RATE_LIMIT_UNIT_TABLE shape, the future M4 admission webhook’s accepted-suffix listing in its rejection body, any future round-trip fuzz harness). A future variant addition to RateLimitUnit extends this slice as a single edit and every consumer picks up the new entry by construction — the compiler- checked exhaustiveness on the sibling method match arms is the build-time guarantee that no arm forgets to grow.

pub const fn as_suffix(self) -> &'static str

Canonical author-surface suffix — the "s" / "m" / "h" byte- string every <n>/<unit> rate-limit shape carries after its / separator. The single source of truth the codec’s parse and render arms both dispatch on: the parse arm matches an incoming suffix against every RateLimitUnit::ALL entry’s as_suffix output; the render arm emits the entry’s as_suffix verbatim after the rate magnitude.

pub const fn window(self) -> Duration

Canonical Duration for this unit — the token-bucket refill period the RateLimit::window axis carries when the surrounding slot’s :rate-limit author surface named this unit.

pub fn from_suffix(suffix: &str) -> Option<Self>

Parse the <n>/<unit>-shaped suffix into the typed enum, or None when suffix is outside the closed-set arm-string set Self::as_suffix emits. The single str → Self projection [rate_limit_codec::parse] consumes.

pub const fn from_window(window: Duration) -> Option<Self>

Recognize a canonical rate-limit Duration as one of the three arms, or None when window carries sub-second residue or a second-magnitude outside the closed-set arm-window set Self::window emits. The single Duration → Self projection [rate_limit_codec::render] + [is_canonical_rate_limit_window] both consume.

pub const fn — the reverse Duration → Self projection now carries the same const-eval-surface posture the sibling pub const fn Self::as_suffix / Self::window scalar- projection accessors on this closed-set typed enum already carry, and the paired pub const fn RateLimit::canonical_unit typed-RateLimit-projection sibling composes through in const context. Routes byte-for-byte through the peer pub const fn Self::window canonical-Duration projection so any future arm-magnitude edit on the sibling accessor reaches this reverse resolver by construction — the s == Self::<Arm>.window().as_secs() per-arm probes each dispatch through one pub const fn on the substrate primitive rather than a hand-authored per-arm second- magnitude literal that would silently drift on any future Self::window arm-magnitude edit.

Prior to the const lift the body dispatched through Self::ALL.iter().copied().find(|u| u.window() == window) — an iterator-driven linear scan whose iterator methods (.iter() / .copied() / .find()) and Duration-side PartialEq dispatch each carry non-const bounds on stable Rust 1.94, so any downstream substrate-side const-context consumer of the reverse resolver (a module-scope const _:() = assert!(RateLimitUnit::from_window(<canonical>).is_some()) invariant pin on a typed fixture, a future M4 mesh.pleme.io/v1alpha1/Aplicacao CR materializer admission- webhook const fn per-:politicas canonical-window floor over a typed RateLimit scalar, any future const fn per-:contratos-edge rate-limit-override overlay resolver over the substrate primitive that wants to fan on the canonical unit at compile time) surfaced as a downstream E0015 far from the resolver’s own declaration. The pub const fn posture closes the drift structurally at caixa-core build time.

Pinned load-bearing at the substrate-primitive level by [tests::rate_limit_unit_from_window_accessor_is_const_fn] (const- eval-surface pin via const fn wrapper) and [tests::rate_limit_unit_from_window_composes_through_window_accessor] (composition-witness pin against the peer Self::window scalar dispatch).

pub fn window_from_suffix(suffix: &str) -> Option<Duration>

Canonical rate-limit Duration for a unit suffix, or None when suffix is outside the closed-set arm-string set Self::as_suffix emits. Composes Self::from_suffix with Self::window — the single &str → Duration projection [rate_limit_codec::parse] consumes.

The peer Duration → &'static str axis folded onto the substrate primitive RateLimit::canonical_unit typed accessor once both production consumers ([rate_limit_codec::render] and AplicacaoSpec::validate_politicas’s canonical-window gate) migrated (61421a6): the free helper’s Duration → &str projection is now the two-step composition rl.canonical_unit().map(RateLimitUnit::as_suffix) every consumer reads through the typed accessor. This lift closes the peer &str → Duration axis by folding the vestigial module-private rate_limit_window_from_unit delegate onto this associated method — the codec’s parse arm and every future wire-side consumer of the &str → Duration projection (a future admission-webhook that reads a :rate-limit shape off a CR spec’s raw string value before it’s promoted to a validated typed slot, a future feira lint shape-probe that reads the author-surface bytes verbatim) now reach for exactly one typed dispatch on the substrate primitive.

Same “closed-set typed-enum discriminator with canonical projections per axis” discipline the sibling Self::as_suffix / Self::window / Self::from_suffix / Self::from_window methods carry — this associated method closes the fifth (and last unlifted) projection axis on the arm-table, so the closed-set enum now owns every str ↔ Duration ↔ Self typed dispatch every consumer of the :politicas :rate-limit :window axis reaches through. A future rate-limit-unit addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support, a "ms" sub-second window once high-throughput per-edge policies come into scope per MESH-COMPOSITION §III.2 #3) is one new variant plus one arm per method — the compiler enforces exhaustiveness on every consumer’s match self arms and picks the new unit up by construction across all five projections.

Trait Implementations

impl AsRef<str> for RateLimitUnit

Substrate-canonical AsRef<str> projection on the M3 :politicas :rate-limit closed-set typed unit-suffix enum — routes through the same RateLimitUnit::as_suffix pub const fn scalar accessor the paired std::fmt::Display impl already delegates through, so any future consumer that binds a RateLimitUnit through the standard-library impl AsRef<str> bound (a std::process::Command::arg shell-out that composes the canonical suffix into an Envoy sidecar config-CLI’s per-:politicas --rate-limit-unit <s|m|h> arg on the future CiliumClusterwideEnvoyConfig overlay MESH-COMPOSITION §III.2 #3 names, a tracing::field::Value::Str-arm structured-log recorder on the future app-operator’s per-:politicas :rate-limit reconcile step, a std::collections::HashMap lookup keyed on the canonical suffix through map.get::<str>(unit.as_ref()) on a future per-unit token-bucket-refill dispatch table the future M4 admission-webhook rejection body composes) reaches the paired "s" / "m" / "h" byte-string through one substrate-primitive dispatch rather than an open-coded .as_suffix() re-inlining at every wire-up.

Deliberately routes through the canonical suffix axis, not the second-magnitude RateLimitUnit::window axis — AsRef<str> and [fmt::Display] land on the same author-surface-canonical byte- string the codec’s parse and render arms both dispatch on, while the token-bucket-refill period stays reachable only through the explicit RateLimitUnit::window / RateLimitUnit::from_window paths.

Same “route the trait impl through the substrate-primitive accessor” discipline the sibling crate::CaixaVersion AsRef<str> impl (16d5c7e), the paired M2 crate::supervisor::RestartStrategy AsRef<str> impl (63eb1a4), the paired M2 crate::supervisor::RestartPolicy AsRef<str> impl (419ea81), the M3 PlacementStrategy AsRef<str> impl (d86edd2), and the top-level crate::CaixaKind AsRef<str> impl (cd2091f) carry — closes the substrate primitive’s AsRef<str> projection axis onto the last remaining closed-set typed enum with a [fmt::Display] surface, so every closed-set typed enum / newtype on the caixa surface (top-level :kind, both M2 :supervisor-slot per-child and sibling-restart typed enums, the M3 :placement :estrategia typed enum, the M3 :politicas :rate-limit unit-suffix typed enum, and the :versao typed newtype) now carries the paired AsRef<str> + [fmt::Display] + as_* triple through one lifted-const family.

Pinned load-bearing by [tests::rate_limit_unit_as_ref_str_routes_through_as_suffix_accessor] (byte-parity pin against RateLimitUnit::as_suffix across the three-arm closed set) and [tests::rate_limit_unit_as_ref_str_routes_through_display_via_shared_accessor] (three-path convergence: AsRef<str> + Display + as_suffix all resolve to the same byte-string per arm) — any future silent detour that routes the impl through a divergent projection (a per-arm inline match self { … } re-inlining that opens a compile- time link to the un-lifted arm-literal, a swap onto the second-magnitude RateLimitUnit::window axis that would collide the canonical-suffix / token-bucket-refill two-axis split) trips at caixa-core test time under assert_eq! rather than at a downstream impl AsRef<str>-bound consumer’s silent split.

fn as_ref(&self) -> &str

Converts this type into a shared reference of the (usually inferred) input type.

impl Clone for RateLimitUnit

fn clone(&self) -> RateLimitUnit

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RateLimitUnit

impl Debug for RateLimitUnit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RateLimitUnit

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for RateLimitUnit

Route std::fmt::Display through RateLimitUnit::as_suffix, so every consumer that formats a canonical rate-limit unit as user- facing text (future M4 admission-webhook rejection bodies naming the accepted-suffix set, future feira app graph per-:politicas unit column) lands on the same "s" / "m" / "h" byte-string the codec’s parse arm accepts and the render arm emits. Same as_str-through-Display convergence discipline the sibling PlacementStrategy, crate::CaixaKind, crate::supervisor::RestartStrategy, and crate::supervisor::RestartPolicy closed-set typed enums carry.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RateLimitUnit

impl From<RateLimitUnit> for &'static str

Standard-library trait-idiomatic forward projection on the RateLimitUnit closed-set typed enum. Routes byte-for-byte through the paired substrate-primitive RateLimitUnit::as_suffix pub const fn accessor so <&'static str>::from(unit) / unit.into::<&'static str>() reaches the same three-arm "s" / "m" / "h" canonical-suffix emit-set the sibling method-named accessor dispatches through and the sibling [std::fmt::Display for RateLimitUnit] / [AsRef<str> for RateLimitUnit] impls also route through.

Extends the substrate-wide closed-set-enum trait-idiomatic forward-projection family (crate::supervisor::RestartStrategy via 523157d, crate::supervisor::RestartPolicy via 9fb37d0, crate::CaixaKind via edb827b, crate::CaixaDialeto via c189a6f, PlacementStrategy via afa3562, WitShape via 56998ec) onto the third M3-mesh-primitive-defining slot enum on the caixa surface — the :politicas :rate-limit canonical-unit-suffix closed set the caixa-mesh renderer keys off end-to-end for per-Aplicacao Envoy local_rate_limit.token_bucket.fill_interval overlay emission. Pairs with the sibling [TryFrom<&str> for RateLimitUnit] impl (bf78400) to close the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair, mirroring the pre-existing method-named RateLimitUnit::as_suffix + RateLimitUnit::from_suffix pair on the substrate-primitive axis pair.

Return type is &'static str by construction — every RateLimitUnit::as_suffix arm resolves to an inline "s" / "m" / "h" &'static str literal, so the trait’s return-type promise is upheld structurally without a String::leak cast or a per-arm inline literal outside the paired RateLimitUnit::as_suffix dispatch.

Deliberately routes through the canonical-suffix axis, not the second-magnitude RateLimitUnit::window axis — every closed-set forward-projection path on the caixa surface lands on the same author-surface-canonical byte-string the codec’s parse and render arms both dispatch on, while the token-bucket-refill period stays reachable only through the explicit RateLimitUnit::window / RateLimitUnit::from_window paths.

The paired RateLimitUnit::as_suffix accessor’s three-arm emit-set is the single source of truth — every future arm addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support, a "ms" sub-second window once high-throughput per-edge policies come into scope per MESH-COMPOSITION §III.2 #3 — both trajectory items the sibling RateLimitUnit::window_from_suffix doc block already names) grows the trait-idiomatic forward axis by construction: one caixa-core edit on RateLimitUnit::as_suffix extends every one of the sibling forward-projection paths (std::fmt::Display, AsRef<str>, RateLimitUnit::as_suffix itself, and this [From<Self> for &'static str]) without a coordinated rewrite across every future Into<&'static str>-bound consumer’s arm-set.

Pinned load-bearing by [tests::rate_limit_unit_from_into_static_str_routes_through_as_suffix_accessor] (byte-parity pin against RateLimitUnit::as_suffix across the three-arm emit-set, plus a const-context materialization witness for the &'static str lifetime promise routed through the paired RateLimitUnit::as_suffix pub const fn accessor, plus a paired .into() shape assertion covering the blanket-derived Into<&'static str> shape) and [tests::rate_limit_unit_from_into_static_str_and_as_suffix_partition_the_emit_set] (partition pin asserting <&'static str as From<RateLimitUnit>>::from and RateLimitUnit::as_suffix agree on every arm, plus a two-way direct round-trip witness through the paired trait-idiomatic TryFrom<&str> axis that closes the two-way Self ↔ &'static str round-trip on the trait-idiomatic axis pair — the emit-side RateLimitUnit::as_suffix and the parse-side RateLimitUnit::from_suffix dispatch on the same three inline canonical-suffix byte-strings by construction, so round-tripping composes the two trait impls directly).

fn from(unit: RateLimitUnit) -> &'static str

Converts to this type from the input type.

impl Hash for RateLimitUnit

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for RateLimitUnit

fn eq(&self, other: &RateLimitUnit) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RateLimitUnit

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RateLimitUnit

impl TryFrom<&str> for RateLimitUnit

Trait-idiomatic reverse projection on the M3-mesh-primitive-defining RateLimitUnit closed-set typed enum — routes byte-for-byte through the paired substrate-primitive RateLimitUnit::from_suffix Option<Self> accessor so every future consumer that binds a canonical :politicas :rate-limit unit-suffix byte-string through the standard-library .try_into() / TryFrom axis (a future feira app policy --rate-limit-unit <s|m|h> CLI arg-parse that composes into let unit: RateLimitUnit = s.try_into()?, a future mesh.pleme.io/v1alpha1/Aplicacao CR admission-webhook that folds a spec.politicas.rateLimit.unit: String field through RateLimitUnit::try_from(&s)?, a generic <T: TryFrom<&str>>-bound loader over any of the substrate’s closed-set typed enums) reaches the same three-arm accept-set the sibling RateLimitUnit::from_suffix resolver parses through and the sibling RateLimitUnit::as_suffix emits, rather than an open-coded per-arm match s { "s" => …, "m" => …, "h" => …, _ => … } cascade whose arm-set has no compile-time link back to the substrate primitive.

Complements the pre-existing forward-projection triple (std::fmt::Display, AsRef<str>, RateLimitUnit::as_suffix) with the paired trait-idiomatic reverse-projection axis: Rust-side newtype/typed-enum convention pairs AsRef<str> with either std::str::FromStr or TryFrom<&str> on the same primitive so a caller who can project out to a &str can also project in from one. The TryFrom<&str> axis is deliberately chosen over std::str::FromStr to sidestep the clippy::should_implement_trait lint the sibling method-named RateLimitUnit::from_suffix would trigger under a FromStr impl (the same design tradeoff the peer crate::CaixaKind (3c83606), crate::CaixaDialeto (bf33136), PlacementStrategy (6fd00cd), crate::supervisor::RestartStrategy (5b828ed), crate::supervisor::RestartPolicy (6fdd0d9), and WitShape (5472902) blocks note) — this impl closes the trait- idiomatic reverse axis without disturbing the method-named from_suffix shape the peer closed-set typed enums already carry.

type Error = () matches the sibling RateLimitUnit::from_suffix’s Option<Self> return-shape’s deliberate deferral of error typing: the caller picks the diagnostic form appropriate for its use site (a future feira app policy --rate-limit-unit arg-parse composes its own per-verb “unknown rate-limit unit: — accepted: {…}” message enumerating RateLimitUnit::ALL, a future M4 admission- webhook rejection body wraps the Err(()) outcome with the accepted- set enumeration for operator diagnostics, a Result::map_err at the call site lifts the unit-error to a per-verb error type). Same shape the peer sibling reverse-projection axes carry.

The paired TryFrom<&str> impl reaches the same three-arm accept- set the RateLimitUnit::from_suffix resolver dispatches through, so any future arm addition (a "d" day suffix once Envoy’s rate_limit_action grows daily-bucket support, a "ms" sub-second window once high-throughput per-edge policies come into scope per MESH-COMPOSITION §III.2 #3 — both trajectory items the sibling RateLimitUnit::window_from_suffix doc block already names) grows the trait-idiomatic axis by construction — one caixa-core edit on RateLimitUnit::from_suffix extends both the method-named reverse projection every existing consumer keys off and the trait-idiomatic reverse projection this impl exposes, without a coordinated rewrite across every future TryFrom<&str>-bound consumer’s arm-set.

Extends the substrate-wide closed-set-enum trait-idiomatic reverse- projection family (crate::CaixaKind via 3c83606, crate::CaixaDialeto via bf33136, PlacementStrategy via 6fd00cd, crate::supervisor::RestartStrategy via 5b828ed, crate::supervisor::RestartPolicy via 6fdd0d9, WitShape via 5472902) onto the third M3-mesh-primitive-defining slot enum on the caixa surface — the :politicas :rate-limit unit-suffix closed set the caixa-mesh renderer keys off end-to-end for per-Aplicacao Envoy local_rate_limit.token_bucket.fill_interval overlay emission, and the future M4 mesh.pleme.io/v1alpha1/Aplicacao CR admission- webhook’s per-:politicas accept-set validation.

Pinned load-bearing by [tests::rate_limit_unit_try_from_str_routes_through_from_suffix_accessor] (byte-parity pin against RateLimitUnit::from_suffix across the three-arm accept-set) and [tests::rate_limit_unit_try_from_str_rejects_unknown_byte_strings] (rejection witness against silent accept-set widening).

type Error = ()

The type returned in the event of a conversion error.

fn try_from(s: &str) -> Result<Self, Self::Error>

Performs the conversion.